Remcos RAT Loader - In-Memory DLL Loading from Temporary Location

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•1

This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.